github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()

Browse Source 
'level' is user space controlled and used to read from an array. Add the
missing array_index_nospec() call to prevent speculative execution.

Cc: stable@vger.kernel.org
Fixes: 0d30871739 ("s390/diag: Add memory topology information via diag310")
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
This commit is contained in:
Heiko Carstens 2026-06-22 16:31:24 +02:00 committed by Vasily Gorbik
parent 8cdeaa50ea
commit b7577fe4c4
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
arch/s390/kernel/diag/diag310.c
View File

@ -190,17 +190,18 @@ static int memtop_get_stride_len(unsigned long *res)
static int memtop_get_page_count(unsigned long *res, unsigned long level)
{
static unsigned long memtop_pages[DIAG310_LEVELMAX];
unsigned long pages;
unsigned long pages, idx;
int rc;
if (level > DIAG310_LEVELMAX || level < DIAG310_LEVELMIN)
return -EINVAL;
pages = READ_ONCE(memtop_pages[level - 1]);
idx = array_index_nospec(level - 1, ARRAY_SIZE(memtop_pages));
pages = READ_ONCE(memtop_pages[idx]);
if (!pages) {
rc = diag310_get_memtop_size(&pages, level);
if (rc)
return rc;
WRITE_ONCE(memtop_pages[level - 1], pages);
WRITE_ONCE(memtop_pages[idx], pages);
}
*res = pages;
return 0;